From d9b44acb6871837caf6f6d962af824cf9eebe667 Mon Sep 17 00:00:00 2001 From: Alexandru Avadanii Date: Thu, 11 Apr 2019 16:04:03 +0200 Subject: route mcpcontrol via PXE br to bypass isolation Recent virsh/Docker network rework changed mcpcontrol (previously a virsh-managed network) into a Docker-controlled network using the 'bridge' driver. As a consequence, Docker now isolates traffic from 'mcpcontrol' network from the default Docker bridge network ('docker0') using iptables rules that check input/output interfaces. Yardstick (and any other Docker container hooked via 'docker0') will not be able to ssh into Salt master due to this isolation. One possible workaround would be to explicitly ACCEPT traffic from 'docker0' going to Salt master. However, this is only properly supported starting with Docker 17.06, while most CI hosts and end users are still using 17.05 or older. In older Docker releases, DOCKER-USER iptables table was not avaiable, so injecting custom iptables and making them persistent is not only complicated, it's also prone to subtle errors. Another way to bypass the iptables rules is to route the packets coming from our new Docker network via another bridge before letting them find their way into 'docker0'. This change adds a new route for the Salt master host (note that MaaS container will not benefit from this) via the PXE bridge on the jumphost (which can be either a real Linux bridge for baremetal deployments or a virsh-managed network); adding one extra network hop for each packet going between our 'mcpcontrol' Docker network and 'docker0', effectively bypassing the Docker-enforced iptables DROP. Change-Id: Id8ac7a638c778887b361c9b64c320664c88f59fd Signed-off-by: Alexandru Avadanii --- mcp/scripts/lib_jump_deploy.sh | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/mcp/scripts/lib_jump_deploy.sh b/mcp/scripts/lib_jump_deploy.sh index ade1a7487..8b7f6a569 100644 --- a/mcp/scripts/lib_jump_deploy.sh +++ b/mcp/scripts/lib_jump_deploy.sh @@ -328,7 +328,8 @@ function create_networks { ${PREFIX}/brctl showstp ${all_vnode_networks[1]} > /dev/null 2>&1' ExecStart=/bin/sh -ec '\ ${PREFIX}/brctl addif ${all_vnode_networks[0]} veth_mcp0 && \ - ${PREFIX}/brctl addif ${all_vnode_networks[1]} veth_mcp2' + ${PREFIX}/brctl addif ${all_vnode_networks[1]} veth_mcp2 && \ + ${PREFIX}/ip route add ${SALT_MASTER} dev ${all_vnode_networks[0]}' EOF sudo ln -sf "${FUEL_VETHC_SERVICE}" "/etc/systemd/system/multi-user.target.wants/" sudo ln -sf "${FUEL_VETHA_SERVICE}" "/etc/systemd/system/multi-user.target.wants/" -- cgit 1.2.3-korg